Every article tagged OWASP, in one place.
Showing 4 articles
The OWASP Top 10 is a widely used awareness list of the most critical web application security risks, based on data from real applications. It's updated every few years; the 2025 edition reflects how modern apps are built, with supply chains and cloud configur...
Broken access control means a user can do something they shouldn't be allowed to. The most common form is IDOR (insecure direct object reference): change an ID in a request and see someone else's data. The vulnerable pattern // GET /api/invoices/1043 app.get('...
SQL injection happens when user input is pasted into a SQL string, letting an attacker change the query itself. It's old, well understood and still found in production code. The vulnerability // email comes from a login form const sql = `SELECT * FROM users WH...
Cross-site scripting (XSS) lets an attacker run their JavaScript in other users' browsers on your site. With it they can read data on the page, act as the user, or steal tokens kept in JavaScript-accessible storage. How it happens // A comment saved as: <img s...
